Let's continue to implement the authentication system using JSON Web token.
But before we continue, guys, I made some slight mistake here.
Inside the verification token, we need to return from this function because let's say that if I tamper
with the token, so let me change the token like this one.
And if I go ahead and run the file, let's see.
You can see that.
Let me run the file again where you can see that I got nothing because at this point the token has.
You can see that I got nothing down here.
I was expecting this message to be displayed.
So let's go ahead and then assign the result to a variable called the user verified so it can be user
or user verified.
So let's go ahead and then console the user.
Well, you can see that I got undefined simply means that we are not returning this function from our
verification token.
So here, let's go ahead and return from this function.
And with this one, let's have a look.
You can see that we have the message called status failed and message invalid, token or token expired.
But if I provide the right token, which is this one and let me pass it inside the function call and
let's save it.
And you can see that we got the user back.
That is perfect.
So now we have fixed that particular back.
So let's continue the flow.
Now we've got all what we need.
That is we're able to generate and able to verify.
So what is the next step looking at this flow?
What it says is that upon every request we need to send the token as part of the header.
So how are we going to send the token as a header when making requests?
So let's work with the profile roots, which is down here.
So what we are going to do is that when a user visit this root, we want to have access to the token
and then we take that token to verify.
And after verification we have the user, then we can pass to this template and show it on the page
and that is what we are going to do.
So because we are dealing with API, let's go ahead and then refactor this route a little bit.
So let's remove this one and let's remove everything from this root and let's start from scratch because
we are dealing with API, we are not going to send any template for now.
So here we go.
So inside here, let's send a message by saying that welcome to your profile page and let's provide
status.
Is going to be success.
All right.
So let's go ahead and hit that route.
So let's create one requests.
So let me let me duplicate this one.
And this one is going to be let me rename it as profile.
Here we go.
Good.
So here you're going to be profile.
When I hit send is get request.
So let's change to get and let's save the roots and hit send.
And we have what is called welcome for this one.
There is no payload.
So let's remove this one and let's have some enough room.
A good lesson again we have.
Welcome to your profile.
So when I hit this profile, I want to display the log in user.
So let's see how we are going to implement that back to the root core profile.
We want to have access to the token and how are we going to get it.
And remember we said that when making the request, which means we are making requests to this endpoint
core profile and we want to send the token.
So how are we going to pass the token when making requests to this route?
And this is how we're going to do it and our headers click on that.
Let's have some enough room here.
And, and the HTTP is we are going to pass additional payload call authorization and the value here
is going to be bearer, make sure you type in that name.
And next is we pass in the token the token as that copy it and let's paste it here after borough space
once paste and then let's paste that and let's make the requests.
All right.
Now, you can see that there is nothing being displayed than the static text.
But as soon as we do that inside here, we have access to the rec.
Dot headers, so let's go ahead and console.log the rec dot headers and let's see.
So with this one, if I make the request to the root, let's see.
And there we go.
And we have some properties on the header called the user agent, meaning the two that we are using
to make the request which is the ten dot client and we have accept don't worry about this one, but
what we care most is the authorization and you can see that we have.
Bera And then our token which is this and this is what we want.
So the whole logic is that we want to grab the token from this header and looking at this structure
is going to be a little bit difficult to get the token because one, we can quickly make use of that
authorization.
But what about the value?
We have a value called bearer, but we don't want this one.
What we want is this.
So we need to write some JavaScript to get it done.
So here we go back to the file.
So now how can we get the headers?
And this is how we are going to do so let's declare a variable called header object.
So here we go.
Const header.
Object is equal to req dart headers as you saw on the console and if you console log header object,
you're going to get what we saw.
So the next is let's go ahead and grab the token.
So const token is equal to remember we have header object dot authorization.
So with this one, if you go ahead and console.log the token, let's have a look inside our terminal.
Let's see if you have the token.
Let's make the request again and we have the token.
But instead we have bearer and then token.
So let's ignore this one and take this and we can use split to split this one and take the second index
of this.
So this is how we are going to do so.
Back here we can add what is called dot splits and you want to split, wait, empty space as we saw,
and then you want to take the first index.
So this one before we take that, let's save it.
And now let's try again make the requests.
And you can see that we have an array with the first value which is index zero and the second value
at index one, we can get that one from here as index one.
So with this one, again, if I make the request and now I have the token down here with that bearer
and for this one we can write it as using the square bracket.
So here, remember how we can get property from objects, we can go by this or using the square bracket
as that.
And let's remove the let's remove the dot from here and put this one in code.
And this one also in this one is more dynamic.
All right.
So now, again, if I make the requests I have to took him.
That is great, guys.
So when we get that one, what we want to do is that we want to verify the token.
Do you remember, as we did before?
So back here, after getting this token, we want to verify the token here going to be verify.
Tolkien.
So here is going to be get Tolkien from header so here get.
So let's go ahead and call the function for verifying token, which is this one.
Let's remove this function here and now let's go ahead and call the function inside the profile root,
which is this.
So we're going to call verify token, then pass in the token we got and now I have access to the user
code, decoded user code to what I got back from verification so I can go ahead and then send the user
as a response code decoded user.
So here is a magic.
Now if I go to the profile root and now as part of the response, let's have a look.
Hey, we have the user back as that.
That is great.
Well, so with this one, we can pass this user to a template to be rendered on the page as we did for
session and cookie based authentication.
Do you get it?
Yeah, but a caveat thing here is that, guys, you don't need to expose the user details like this
one.
You see that we are retaining everything from here, like the user name, the foo, name, the password,
everything.
So the idea way is that we got this details because upon generating or signing in the token we use the
entire user, which is let me show you here the general token function which is up here.
Let me show you the generate.
This one can see that we are using the and how user details, but ideally we use the ID only and then
when we go the ID inside any route, we can get the ID and then make a request to MongoDB to find that
particular user with that particular ID.
So by convention we only sign a user with ID as that and you can get a one from the user underscore
ID as that.
So when registering instead of just passing in the entire user details, which is here, we are going
to sign in the user with all the ID.
So here going to be going to pass in as an object.
But instead what I want is the user and remember the user represents this one.
Let me show you the generate here is this.
And because it's an object, we can get the ID to get it.
Yes, I get it.
Or better so we can provide ID here to be more specific.
To be more specific as the ID.
All right.
So let's see how we are going to get the ID also and pass N.
So here we go.
We can quickly pass in the user found and then dot underscore ID.
So that is it.
We are passing in the ID only.
So it means that upon verification we are going to get the ID of the user only without the payload like
foo name and username.
So let's have a look.
Now if I log in again, you can see that I gave back the token and I'm going to grab this token and
then send as part of the request as payload to my header.
Now let me change the token to this token.
Now when I save it and the user, I'm not going to see all this details, but instead only the ID.
So let's save it.
If we see that now we have the ID only, but if you want you can also ignore the issue, add and retain
only the user ID only.
So inside our profile now to be able to get the actual user, you want to make a request to our database
to fetch that.
So after I here what we are going to do is that.
Step number three is make requests to fetch.
The decoded user.
So here we go.
Remember we have the ID as decoded user dot user dot ID, which is this user dot id.
So const.
User details.
Our user is equal to less away that we making async here.
Yes.
And on the user model, let's find the user by ID and which is under decoded user dot user.
Dart eyed.
So now let's send the user details here.
All right.
So let's see.
Let's go ahead and make the requests.
Well, I guess some error.
I think we are making something wrong here.
Let's see.
Cannot read properly of ID, I think.
Well, let's go ahead and console.log the decoded user and see more details about the structure.
I believe some of you have seen it.
Let's try out and see what we have.
Okay.
We have got ID.
Sorry.
Is the ID?
There is no user here.
All right, so now let's remove this one and let's go to the file like that and let's send and we are
here.
So for this one, you can choose to sign the username and then the full name by doing this way.
So here what you can do is we can structure that and retain what you want.
Good.
So that is how we can make use of it.
Now we are able to access the user in our route.
But what about protecting a route?
So what we are going to do is that we are going to create a middleware instead of just writing inside
this route here.
We are going to create a modular and then pass into this route or any route to check if there is a user.
Then you can go ahead and access any route.
Otherwise, we need to log in to have a token before you can go ahead and access any route.
Let's get into that in the next video.